CVE-2026-13599

highPriorität · verfolgen · 0OT-Risiko · erhöhtCH
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
— EPSS
CVSS 7.8 · high
Is it mine?
2 products
Prüfe deine Angriffsfläche
Who says so?
1 sources
abb_psirt

Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenAbility Edgeniusabb_psirt

    ABB fixed this vulnerability in ABB Ability Edgenius version 3.2.4.1 and later. Customers should upgrade to version 3.2.4.1 or later as soon as possible

  • MitigationAbility Edgeniusabb_psirt

    The following conditions reduce the likelihood of successful exploitation. For additional guidance, see General security recommendations - Ensure systems are accessible only from trusted networks - Restrict access to edge nodes using firewall rules and network segmentation - Maintain up-to-date patches for OS, firmware, and dependent components - Interact only with trusted applications, software packages, and email attachments - Protect systems from unauthorized physical access

  • WorkaroundAbility Edgeniusabb_psirt

    Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove exposure with well-known impact on functionality. For brownfield customers, ABB provides a Kubernetes network policy that restricts access to Edge Authentication Database (AuthDB) to the authorized services required for normal operation of an already deployed and configured system. For implementation details, refer to Technical Description-ABB Ability Edgenius Missing Authentication in Edgenius AuthDB.docx (7PAA025722) listed in the reference section, distributed separately.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.8–7.8

v3.17.8highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · cybersecurity@ch.abb.comAusnutzbarkeit 1.1 · Auswirkung 6
v3.17.8highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C/CR:H/IR:M/AR:H/MAV:L/MAC:H/MPR:L/MUI:N/MS:C/MC:H/MI:H/MA:Hsecondary · ABB PSIRT
v4.05.8mediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:I/V:D/RE:L/U:Ambersecondary · cybersecurity@ch.abb.com
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-306USCWE-306USCWE-306US
05

betroffene Produkte (2)

Betroffene Produkte und Versionsbereiche.

06

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • 7PAA026271ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB 2026-10-22csaf · abb_psirtCH

    ABB identified a critical vulnerability present in ABB Ability Edgenius versions 3.2.3.0 and below. We have not received any reports of this vulnerability being exploited. This issue may allow unauthorized manipulation of the edge authentication database if successfully exploited. ABB has developed and released a corrective update that resolves this vulnerability and enhances the security posture of the affected system.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

abb_psirtNVDCVE.orgMITRE
veröffentlicht 2026-10-22geändert 2026-10-22
08

Referenzen (1) nvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan